Stop Searching. Start Trusting.

The curated directory of MCP servers, vetted for security, efficiency, and quality.

Browse DirectoryWhy Us?

Tired of the MCP "Marketplace" Chaos?

We built MCPScout.ai to solve the ecosystems biggest pain points.

No Insecure Dumps

We manually analyze every server for basic security flaws.

Easy Setup

Our gotcha notes warn you about complex setups.

Avoid "Token Hogs"

We estimate token costs for cost-effective agents.

Products, Not Demos

We filter out "Hello World" demos.

CATEGORIES:
SORT:

Vetted Servers(9120)

0
0
Medium Cost
SvenTern icon

mcp_email

by SvenTern

Sec7

A Streamable HTTP/SSE wrapper that provides MCP tools for comprehensive IMAP/SMTP email management, including account setup, email operations, folder management, and advanced sorting rules.

Setup Requirements

  • ⚠️Requires separate Node.js-based 'imap-mcp-server' to be installed and built, as this server acts as a Python wrapper around it.
  • ⚠️Email providers like Gmail/Yandex require 'App Passwords' (not main passwords) and potentially 2FA to be enabled for IMAP/SMTP access.
  • ⚠️Remote deployment is recommended via Docker and `docker-compose`, requiring Docker environment setup.
  • ⚠️Requires persistent Docker volumes for AES-256 encrypted IMAP account credentials.
Verified SafeView Analysis
The application itself implements good security practices, such as recommending App Passwords (not main passwords) for email providers and using AES-256 encryption for storing credentials in Docker volumes. Attachment downloads use temporary, single-use tokens. However, the provided deployment documentation and scripts contain hardcoded SSH passwords, which is a critical security vulnerability for the deployment process itself. Additionally, the README explicitly states 'CORS: Включен для всех источников' (CORS: Enabled for all sources), which can be a significant risk if not adequately mitigated by a robust reverse proxy (like Nginx with strict origin validation). The Python wrapper communicates with an underlying Node.js IMAP server via STDIO, which is generally secure for inter-process communication.
Updated: 2026-01-17GitHub→
0
0
Low Cost
iogi icon
Sec5

Deploys an authentication-less Remote Model Context Protocol (MCP) server on Cloudflare Workers, providing basic calculator tools for AI agents.

Setup Requirements

  • ⚠️Requires a Cloudflare account for deployment.
  • ⚠️Requires Node.js, npm, and Cloudflare Wrangler CLI for local development and deployment.
  • ⚠️The server is intentionally deployed without authentication. This is suitable for a demo or local testing, but highly insecure for public production use without implementing additional security measures.
Verified SafeView Analysis
The server is explicitly designed 'without authentication' for demonstration purposes, as stated in the README. While this simplicity enables easy setup for testing, deploying such a server publicly without adding proper authentication mechanisms (e.g., API keys, OAuth) would be a critical security vulnerability, allowing anyone to access and use its tools. The code itself performs input validation using Zod schemas for the defined tools, and no obvious code-level vulnerabilities like RCE or hardcoded secrets are present.
Updated: 2025-12-01GitHub→
0
0
High Cost
jbandu icon

routes-mcp

by jbandu

Sec9

This server provides intelligent route network analysis, optimization, and competitive intelligence for airline operations, serving as a canonical source of truth for planning and strategic insights.

Setup Requirements

  • ⚠️Requires Node.js >= 18.0.0, PostgreSQL >= 14, and Neo4j >= 5.0 (Neo4j is optional but recommended for full functionality).
  • ⚠️Requires Ollama to be running locally (if LLM_MODE is 'ollama') or an Anthropic Claude API key for AI-powered analysis.
  • ⚠️Initial database setup involves multiple manual steps: creating the PostgreSQL database, running migrations (`npm run db:migrate`), and seeding sample data (`npm run db:seed`).
Verified SafeView Analysis
The server demonstrates good security practices by using parameterized queries for PostgreSQL interactions, preventing SQL injection vulnerabilities. Environment variables are properly externalized via `.env` for sensitive configurations like database credentials and API keys. Integration points for external MCPs (Aircraft, Crew) and external APIs (FlightAware, OAG, LLMs) are noted, with some currently using mock data, indicating a structured approach to external dependencies. While the eventual implementation of these external calls and LLM integrations could introduce new attack vectors (e.g., SSRF, prompt injection), the core framework itself does not show any obvious immediate security flaws like 'eval' or hardcoded secrets.
Updated: 2025-11-28GitHub→
0
0
Medium Cost
ani-me-sh icon

test-remote-server

by ani-me-sh

Sec9

A personal expense tracking server providing tools to add, list, and summarize financial entries.

Setup Requirements

  • ⚠️Requires Python 3.12 or newer.
  • ⚠️Expense data stored in the database will be lost when the system restarts, as it uses a temporary directory for the SQLite database.
Verified SafeView Analysis
The server uses parameterized SQL queries, which prevents SQL injection vulnerabilities. No 'eval' or similar dangerous dynamic code execution is present. No hardcoded sensitive secrets were found. The database is stored in a temporary directory, which means data will be lost on system restart; while not a security vulnerability per se, it's a critical operational consideration for data persistence. The FastMCP server listens on all interfaces (0.0.0.0) on port 8000, which is standard but means it's publicly accessible if not protected by a firewall.
Updated: 2025-11-19GitHub→
0
0
Medium Cost
tbelfort icon
Sec9

Fetches structured Google SERP (Search Engine Results Page) data from Serper.dev for SEO agents or any application requiring programmatic access to search results.

Setup Requirements

  • ⚠️Requires a Serper.dev API Key (Serper.dev is a paid service).
  • ⚠️Requires Python 3.12 or newer.
  • ⚠️Only stdio transport is supported; HTTP transport is a stub and not functional.
Verified SafeView Analysis
The server demonstrates good security practices: - `SERPER_API_KEY` is loaded from environment variables and explicitly checked for existence before use, preventing hardcoding. - Logging redaction is implemented via `RedactingJsonFormatter` and `redact_mapping` to prevent sensitive data from appearing in logs. - The HTTP transport is explicitly marked as a 'stub' and raises a `NotImplementedError`, preventing unhardened HTTP endpoints from being accidentally exposed. - The primary transport is stdio, which is generally safer for inter-process communication. - Input validation with Pydantic schemas is used for tool arguments, mitigating injection risks. - Concurrency limits and request timeouts are configurable, helping prevent resource exhaustion.
Updated: 2025-11-21GitHub→
0
0
Medium Cost
Sankararao-k icon

mcp-server

by Sankararao-k

Sec5

Provides a server implementation for Minecraft, likely based on the Minecraft Coder Pack (MCP) for game hosting or development.

Setup Requirements

  • ⚠️Requires Java Development Kit (JDK) installed.
  • ⚠️May require network configuration (e.g., port forwarding) for external access.
Review RequiredView Analysis
No source code provided beyond the README.md; unable to perform a comprehensive security audit for 'eval', obfuscation, hardcoded secrets, or malicious patterns. Operating any game server may expose the host to network risks if not properly secured.
Updated: 2025-11-26GitHub→
0
0
Medium Cost

mcsmcp-gt

by williamligt

Sec6

This is a TypeScript-based server application, likely a backend service or control panel, designed for cloud deployment (Azure) with Docker.

Setup Requirements

  • ⚠️Requires Docker to run containerized.
  • ⚠️Requires Node.js and npm/yarn for local development/execution outside Docker.
Verified SafeView Analysis
Cannot verify code for 'eval' or obfuscation as source code is unavailable. As a server application, it will expose network ports and requires proper configuration (e.g., authentication, input validation) for secure deployment.
Updated: 2025-11-18GitHub→
0
0
Medium Cost
bioanywhere icon

pizza

by bioanywhere

Sec9

A client library to programmatically access news data from thousands of sources, enabling semantic search and content extraction.

Setup Requirements

  • ⚠️Requires a World News API Key (may be paid or require registration).
  • ⚠️Python 3.7+ required for Python client.
  • ⚠️CMake 3.2+, Qt, and a C++ compiler required for C++ client.
Verified SafeView Analysis
The project consists of API client libraries generated by OpenAPI Generator, which generally adheres to good security practices. It handles API key and OAuth2 authentication flows. No direct signs of malicious code, obfuscation, or hardcoded critical secrets are present in the truncated source code. Security largely depends on how users manage their API keys and OAuth tokens when integrating the library.
Updated: 2025-12-13GitHub→
0
0
Low Cost
suissa icon
Sec8

An MCP server to integrate with Mercado Livre API, enabling e-commerce management (products, orders, questions, shipments, metrics) via stdio, REST, or WebSocket for AI assistants.

Setup Requirements

  • ⚠️Requires manual creation of a Mercado Livre application and configuration of `Client ID`, `Client Secret`, and `Redirect URI` on the Mercado Livre Developers Portal.
  • ⚠️Requires an OAuth 2.0 flow to obtain `Access Token` and `Refresh Token`, which can be a multi-step process. A helper script `get-tokens.js` is provided, but it contains hardcoded credentials that must be updated by the user.
  • ⚠️Relies on environment variables (e.g., `MCP_MODE`, `ML_CLIENT_ID`, `ML_ACCESS_TOKEN`) which need to be set, typically via a `.env` file.
Verified SafeView Analysis
The core server code uses `process.env` for credentials, which is good practice. It also includes `try...catch` blocks for error handling in its API endpoints. Input validation schemas are defined with Zod for MCP tools, but the direct application of `.parse()` on all incoming arguments/parameters within server handlers (REST/WebSocket) is not explicitly shown, relying on the internal tool methods to handle types. A utility script `get-tokens.js` hardcodes `CLIENT_ID`, `CLIENT_SECRET`, and `REDIRECT_URI`, which is a security risk if used without modification or exposed.
Updated: 2025-11-22GitHub→
0
0
Low Cost

MCP-Server-Manager

by millsydotdev

Sec6

This project provides tools for managing a server, likely a Minecraft server, with both a Windows GUI and a command-line/scripted approach for installation.

Setup Requirements

  • ⚠️Requires .NET SDK for development and building.
  • ⚠️The GUI component is likely Windows-only.
  • ⚠️Assumes a Minecraft server (or similar 'MCP'-implied server) is the target for management.
Review RequiredView Analysis
The project involves server management and includes a shell script, which could pose security risks if not carefully implemented or if it executes untrusted commands. Without code review, specific vulnerabilities cannot be identified.
Updated: 2025-11-23GitHub→
0
0
Medium Cost
oculairmedia icon

postizz-MCP

by oculairmedia

Sec3

An MCP server integrating with the Postiz social media management platform, enabling AI agents to programmatically create posts, manage integrations, and retrieve social media content.

Setup Requirements

  • ⚠️Requires a Postiz API Key for authentication.
  • ⚠️Requires Node.js 18+ (if not using Docker).
  • ⚠️The provided Docker Compose example includes a hardcoded API key, which must be replaced with a secure method of secret management.
Review RequiredView Analysis
The provided `compose.yaml` file includes a hardcoded `POSTIZ_API_KEY` in plaintext, which is a critical security vulnerability. While the server code itself implements good practices like origin validation, DNS rebinding protection, and proper API key handling via environment variables, the presence of a hardcoded key in an example configuration encourages insecure practices and compromises security if deployed as is. No use of `eval` or obfuscation was found.
Updated: 2025-12-06GitHub→
0
0
Medium Cost
pogao icon

gcp-mcp

by pogao

Sec9

Enables an LLM to safely query and analyze a Google Cloud Platform (GCP) environment for cloud insights.

Setup Requirements

  • ⚠️Requires Python 3.13+
  • ⚠️Requires Google Cloud SDK installed and configured.
  • ⚠️Requires explicit GCP authentication via `gcloud auth application-default login`.
Verified SafeView Analysis
The server provides read-only access to GCP resources, significantly reducing destructive potential. Authentication relies on Google Application Default Credentials, a standard and secure mechanism, with no hardcoded secrets found. Error handling for `PermissionDenied` gracefully returns empty data, avoiding sensitive information leakage. The implementation itself appears robust. The primary security consideration is ensuring the GCP credentials used to run the server have the principle of least privilege applied. The 'unsafe SSH exposure' and 'public bucket analysis' are features for security analysis within GCP, not vulnerabilities of the server itself.
Updated: 2025-12-02GitHub→
PreviousPage 557 of 760Next